[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ffzPgZcJ8o-XoEzuFxTty9ZqN9Sa08RwzkfHSg_rxgxs":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":38,"kevVulnerabilities":97,"topProductsByCves":98,"seoMetadata":104,"meta":113},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":37},11318,"freepbx",5,12,0,845,"2019-10-21","f",[16,21,26,29,33],{"id":17,"product_name":8,"version_count":18,"cve_count":19,"kev_count":11,"last_cve_update":20},46870,654,9,"2019-06-20",{"id":22,"product_name":23,"version_count":24,"cve_count":25,"kev_count":11,"last_cve_update":13},46868,"contactmanager",150,1,{"id":27,"product_name":28,"version_count":25,"cve_count":25,"kev_count":11,"last_cve_update":20},46869,"disa",{"id":30,"product_name":31,"version_count":32,"cve_count":25,"kev_count":11,"last_cve_update":13},46871,"manager",39,{"id":34,"product_name":35,"version_count":25,"cve_count":11,"kev_count":11,"last_cve_update":36},46867,"contact_manager",null,"Freepbx is a technology vendor with 5 tracked products and 12 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[39,48,55,62,68,74,80,85,89,93],{"cveId":40,"description":41,"publishedDate":42,"cvssScore":43,"cvssVersion":44,"severity":45,"isKev":46,"epssScore":47},"CVE-2014-1903","admin\u002Flibraries\u002Fview.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12 before 12.0.1alpha22 does not restrict the set of functions accessible to the API handler, which allows remote attackers to execute arbitrary PHP code via the function and args parameters to admin\u002Fconfig.php.","2014-02-18",7.5,"v2","High",false,0.5181,{"cveId":49,"description":50,"publishedDate":51,"cvssScore":52,"cvssVersion":44,"severity":53,"isKev":46,"epssScore":54},"CVE-2014-7235","htdocs_ari\u002Fincludes\u002Flogin.php in the ARI Framework module\u002FAsterisk Recording Interface (ARI) in FreePBX before 2.9.0.9, 2.10.x, and 2.11 before 2.11.1.5 allows remote attackers to execute arbitrary code via the ari_auth cookie, related to the PHP unserialize function, as exploited in the wild in September 2014.","2014-10-07",10,"Critical",0.43262,{"cveId":56,"description":57,"publishedDate":58,"cvssScore":59,"cvssVersion":44,"severity":60,"isKev":46,"epssScore":61},"CVE-2007-2191","Multiple cross-site scripting (XSS) vulnerabilities in freePBX 2.2.x allow remote attackers to inject arbitrary web script or HTML via the (1) From, (2) To, (3) Call-ID, (4) User-Agent, and unspecified other SIP protocol fields, which are stored in \u002Fvar\u002Flog\u002Fasterisk\u002Ffull and displayed by admin\u002Fmodules\u002Flogfiles\u002Fasterisk-full-log.php.","2007-04-24",6.8,"Medium",0.04456,{"cveId":63,"description":64,"publishedDate":65,"cvssScore":66,"cvssVersion":44,"severity":60,"isKev":46,"epssScore":67},"CVE-2007-2350","admin\u002Fconfig.php in the music-on-hold module in freePBX 2.2.x allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the del parameter.","2007-04-30",6.5,0.02276,{"cveId":69,"description":70,"publishedDate":71,"cvssScore":72,"cvssVersion":44,"severity":60,"isKev":46,"epssScore":73},"CVE-2009-4458","Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.5.2 and 2.6.0rc2, and possibly other versions, allow remote attackers to inject arbitrary web script or HTML via the (1) tech parameter to admin\u002Fadmin\u002Fconfig.php during a trunks display action, the (2) description parameter during an Add Zap Channel action, and (3) unspecified vectors during an Add Recordings action.","2009-12-30",4.3,0.01846,{"cveId":75,"description":76,"publishedDate":13,"cvssScore":77,"cvssVersion":78,"severity":60,"isKev":46,"epssScore":79},"CVE-2019-16967","An issue was discovered in Manager 13.x before 13.0.2.6 and 15.x before 15.0.6 before FreePBX 14.0.10.3. In the Manager module form (html\\admin\\modules\\manager\\views\\form.php), an unsanitized managerdisplay variable coming from the URL is reflected in HTML, leading to XSS. It can be requested via GET request to \u002Fconfig.php?type=tool&display=manager.",6.1,"v3.1",0.01311,{"cveId":81,"description":82,"publishedDate":83,"cvssScore":72,"cvssVersion":44,"severity":60,"isKev":46,"epssScore":84},"CVE-2009-1801","Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, allow remote attackers to inject arbitrary web script or HTML via the (1) display parameter to reports.php, the (2) order and (3) extdisplay parameters to config.php, and the (4) sort parameter to recordings\u002Findex.php. NOTE: some of these details are obtained from third party information.","2009-05-28",0.01263,{"cveId":86,"description":87,"publishedDate":83,"cvssScore":9,"cvssVersion":44,"severity":60,"isKev":46,"epssScore":88},"CVE-2009-1803","FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, generates different error messages for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.",0.01218,{"cveId":90,"description":91,"publishedDate":13,"cvssScore":77,"cvssVersion":78,"severity":60,"isKev":46,"epssScore":92},"CVE-2019-16966","An issue was discovered in Contactmanager 13.x before 13.0.45.3, 14.x before 14.0.5.12, and 15.x before 15.0.8.21 for FreePBX 14.0.10.3. In the Contactmanager class (html\\admin\\modules\\contactmanager\\Contactmanager.class.php), an unsanitized group variable coming from the URL is reflected in HTML on 2 occasions, leading to XSS. It can be requested via a GET request to \u002Fadmin\u002Fajax.php?module=contactmanager.",0.0114,{"cveId":94,"description":95,"publishedDate":83,"cvssScore":59,"cvssVersion":44,"severity":60,"isKev":46,"epssScore":96},"CVE-2009-1802","Multiple cross-site request forgery (CSRF) vulnerabilities in FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, allow remote attackers to hijack the authentication of admins for requests that create a new admin account or have unspecified other impact.",0.00581,[],[99,100,101,102,103],{"id":17,"product_name":8,"version_count":18,"cve_count":19,"kev_count":11,"last_cve_update":20},{"id":22,"product_name":23,"version_count":24,"cve_count":25,"kev_count":11,"last_cve_update":13},{"id":27,"product_name":28,"version_count":25,"cve_count":25,"kev_count":11,"last_cve_update":20},{"id":30,"product_name":31,"version_count":32,"cve_count":25,"kev_count":11,"last_cve_update":13},{"id":34,"product_name":35,"version_count":25,"cve_count":11,"kev_count":11,"last_cve_update":36},{"title":105,"metaDescription":106,"keywords":107,"structuredData":108},"Freepbx - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Freepbx covering 5 products with 12 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Freepbx vulnerabilities, Freepbx security, Freepbx CVE, Freepbx threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":109,"@type":110,"name":111,"description":106,"url":112},"https:\u002F\u002Fschema.org","Organization","Freepbx","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Ffreepbx",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":114,"apiVersion":115},"2026-10-19T18:08:45.233Z","3.0"]